White Circle discloses RISE attack that bypasses safety filters in DALL·E 3, Nano Banana 2, and GPT-Image-2

In a preprint, White Circle disclosed RISE (Red-teaming via Iterative Strategy Evolution), which uses a safety-stripped Qwen3-32B as the attacker and Gemini 2.5 Flash as the judge to find jailbreak strategies that transfer across prompts and models. On DALL·E 3, about 13% of attack prompts produced images manually confirmed as explicit; Nano Banana 2 stayed under 10%, and GPT-Image-2 around 3%. All attack tooling was publicly downloadable and invoked via API. Testing the newly released ChatGPT Images 2.5 and Nano Banana 2.1 with the same method, the researchers say both are 'markedly easier to break' than their predecessors; Google and OpenAI did not respond to requests for comment. For teams running image-generation APIs, this means content filtering cannot rely solely on the underlying model's built-in safety layer; cross-model transferable jailbreak patterns must be part of red-team testing. Developers shipping public text-to-image features on DALL·E 3, Nano Banana 2, or GPT-Image-2 without an independent moderation step face higher real-world abuse risk than vendors publicly claim. White Circle plans to open-source the full attack pipeline on GitHub so model vendors can reproduce and harden defenses, and so policymakers can assess whether mandatory third-party safety testing is needed. White Circle notes the method works even on easily identifiable categories like explicit content, a bad sign for defenses being strengthened against more complex behaviors such as hacking. It speculates the cause is either stronger new models generating a wider range of content, or safety being deprioritized in favor of capability iteration. Shilov says the company is in early talks with government officials about third-party safety testing and argues such testing should be mandatory; White Circle previously took part in Anthropic's bug bounty, but considers its scope limited, unable to cover public research and unwilling to sign NDAs restricting disclosure of key findings.